Trojan:Win32/Remcos.DO!MTB

[Keyser Băsoze]

Hello,

I just tried installing Wargame: European Escalation and I got a warning from Windows Defender about a few Wargame.exe files created during the install process that are apparently infected with Trojan:Win32/Remcos.DO!MTB. Installed failed as the files were quarantined. Scanned one of them on VirusTotal.com and it appears that only Microsoft has it flagged as a trojan, but obviously I still have some doubts now.

I know it might be a false positive, but could anyone from Steam double-check this ? Game's quite old and it appears developer's not answering (and as the install comes from Steam there could be a problem with one of the mirrors maybe) ?

[Keyser Băsoze]

https://www.virustotal.com/gui/file/5dbdb833af4507f88cff348ec8b22df9e3186792a69c8ecd3c1061e6aaef8b81/detection

[The Giving One]

This is why you are supposed to have real-time scan exceptions in any and all security processes for Steam and games.

https://support.steampowered.com/kb_article.php?ref=9828-SFLZ-9289

Anti-virus Software

Anti-virus software hooks very deep into user systems and can affect disk and network operations which will cause issues with Steam. Some games also use copy protection technology that can appear as malicious software to an AV scanner, resulting in potential false-positive alerts.

You'll want to ensure that your AV software is not interfering with Steam. You may also need to add exceptions for Steam and its games in your AV configuration.

[Keyser Băsoze]

Hey, thanks for the reply. I'm aware of that, just never had this happened before with anything coming from Steam (I've also played the game a couple of years ago with no issues) and since the game's quite old and not overly popular for many people to flag it I thought maybe I should double-check, you never know these days...

It does look very much like a false positive, but gonna try and have a scan with Malwarebytes on the actual PC and see if that picks-up on anything.

[The Giving One]

We see this type of thread here from time to time, and it's always just a false positive, if it was downloaded on Steam. If the files were downloaded on Steam, they are fine. Nothing to worry about, really.

Those users usually also say they never saw this happen before. You need to make the exceptions and then verify the game files to get the files that were quarantined back and the game restored as it was when installed :

https://support.steampowered.com/kb_article.php?ref=2037-QEUH-3335

[Keyser Băsoze]

Well, Malwarebytes doesn't detect anything on the PC. HitmanPro also shows an all-clear. Along with VirusTotal only having Microsoft flagging this, fingers crossed for false positive. :)